An Efficient Lightweight Authentication and Key Agreement Protocol for Patient Privacy

Tele-medical information system provides an efficient and convenient way to connect patients at home with medical personnel in clinical centers.In this system,service providers consider user authentication as a critical requirement.To address this crucial requirement,various types of validation and key agreement protocols have been employed.The main problem with the two-way authentication of patients and medical servers is not built with thorough and comprehensive analysis that makes the protocol design yet has flaws.This paper analyzes carefully all aspects of security requirements including the perfect forward secrecy in order to develop an efficient and robust lightweight authentication and key agreement protocol.The secureness of the proposed protocol undergoes an informal analysis,whose findings show that different security features are provided,including perfect forward secrecy and a resistance to DoS attacks.Furthermore,it is simulated and formally analyzed using Scyther tool.Simulation results indicate the protocol’s robustness,both in perfect forward security and against various attacks.In addition,the proposed protocol was compared with those of other related protocols in term of time complexity and communication cost.The time complexity of the proposed protocol only involves time of performing a hash function Th,i.e.,:O(12Th).Average time required for executing the authentication is 0.006 seconds;with number of bit exchange is 704,both values are the lowest among the other protocols.The results of the comparison point to a superior performance by the proposed protocol.

Robust Authentication and Session Key Agreement Protocol for Satellite Communications

Satellite networks are recognized as the most essential communication infrastructures in the world today,which complement land networks and provide valuable services for their users.Extensive coverage and service stability of these networks have increased their popularity.Since eavesdropping and active intrusion in satellite communications are much easier than in terrestrial networks,securing satellite communications is vital.So far,several protocols have been proposed for authentication and key exchange of satellite communications,but none of them fullymeet the security requirements.In this paper,we examine one of these protocols and identify its security vulnerabilities.Moreover,we propose a robust and secure authentication and session key agreement protocol using the elliptic curve cryptography(ECC).We show that the proposed protocol meets common security requirements and is resistant to known security attacks.Moreover,we prove that the proposed scheme satisfies the security features using the Automated Validation of Internet Security Protocols and Applications(AVISPA)formal verification tool and On-the fly Model-Checker(OFMC)and ATtack SEarcher(ATSE)model checkers.We have also proved the security of the session key exchange of our protocol using theReal orRandom(RoR)model.Finally,the comparison of our scheme with similar methods shows its superiority.

Efficient Authenticated Key Agreement Protocol Using Self-Certified Public Keys from Pairings

An efficient authenticated key agreement protocol is proposed, which makesuse of bilinear pairings and self-certificd public keys. Its security is based on the securityassumptions of the bilinear Diff ie-Hellman problem and the computational Diffie-Hellman problem.Users can choose their private keys independently. The public keys and identities of users can beverified implicitly when the session key being generating in a logically single step. A trusted KeyGeneration Center is no longer requiredas in the ID-based authenticated key agreement protocolsCompared with existing authenticated key agreement protocols from pairings, the. new proposedprotocol is more efficient and secure.

Improved Key Agreement Based Kerberos Protocol for M-Health Security

The development of wireless sensor network with Internet of Things(IoT)predicts various applications in the field of healthcare and cloud computing.This can give promising results on mobile health care(M-health)and Telecare medicine information systems.M-health system on cloud Internet of Things(IoT)through wireless sensor network(WSN)becomes the rising research for the need of modern society.Sensor devices attached to the patients’body which is connected to the mobile device can ease the medical services.Security is the key connect for optimal performance of the m-health system that share the data of patients in wireless networks in order to maintain the anonymity of the patients.This paper proposed a secure transmission of M-health data in wireless networks using proposed key agreement based Kerberos protocol.The patients processed data are stored in cloud server and accessed by doctors and caregivers.The data transfer between the patients,server and the doctors are accessed with proposed protocol in order to maintain the confidentiality and integrity of authentication.The efficiency of the proposed algorithm is compared with the existing protocols.For computing 100 devices it consumes only 91milllisecond for computation.

Authentication in Wireless Body Area Network:Taxonomy and Open Challenges

Wearable body area network(WBAN)aids the communication between the health providers and patients by supporting health monitoring services.It assists the users to maintain their health status records by collecting the body signals and transmitting them for further processing measurements.However,sensor data are publicly transferred through insecure network that facilitates the attacker malicious acts like performing masquerading attack,man in the middle,and snooping.Several authentication techniques were suggested to levitate the security of the communication channels to preserve the user data from exposure.Moreover,authentication schemes aid plenty of security issues related to user and data privacy,anonymity,repudiation,confidentiality,and integrity,but they lack performance efficiency.On the other hand,it is very hard to find the balance between security and efficiency in most of the authentication schemes,especially for the WBAN platform that consists of memory and processing constraint devices.Therefore,this paper surveys and discusses the latest authentication schemes types,techniques,and system features.Also,it highlights their strengths and weaknesses towards common knowingly attacks and provides a comparison between the popular scheme validation proofs and simulation tools.Thence,this paper draws a path for the new direction of the authentication technologies,the authentication schemes open issues,and the potential future evolution in this area.

一种可证明安全的ID-AKA协议

基于身份的认证密钥协商(ID-AKA)协议大多效率低下、安全性较低。针对该问题,提出一个新的ID-AKA协议。利用模块化的方法证明新协议在mBR模型满足抗密钥泄露模仿攻击、完美前向安全性以及PKG-前向安全性。新协议还满足抗临时秘密泄露攻击。与同安全级别的协议相比,新协议的效率更高。

增强EAP-AKA协议安全性的改进方案

针对EAP-AKA协议中存在的安全问题,提出了改进方案。通过在3G和WLAN接入网络间增设共享密钥实现了两者间的相互认证,并用串空间模型和认证测试方法进行了形式化分析,通过加密传输NAI实现了对IMSI的加密保护,通过引入密钥更新机制实现了对用户和3G网络间的共享密钥的安全更新。

3G-WLAN互联网络中EAP-AKA协议的分析与改进

3G与WLAN互连是当前研究的一个热点,EAP-AKA是其对应的认证与密钥协商协议。详细分析该协议,修正其中的安全缺陷;并利用哈希链技术和CPK算法实现重认证本地化;最后对该改进方案进行安全性分析。

基于串空间模型的UMTS AKA协议安全分析与改进

通过分析Oh等设计的T-AKA协议,发现该协议无法实现网络对用户的正确认证及消息的新鲜性验证,并利用该安全漏洞构造出了伪冒用户的攻击方法.然后,在3GPP规范的基础上,在服务网络端引入公钥机制,提出了改进的认证与密钥协商协议.最后,应用串空间模型理论及认证测试方法,对改进协议的机密性和双向认证正确性进行了形式化证明.研究结果表明:改进协议能够保证消息的新鲜性和网络-用户间的双向认证,克服T-AKA协议中存在的伪冒用户攻击及其他重放、伪冒攻击,具有高的安全性;协议设计中保留了3GPP规范的框架,避免了用户终端进行繁重的公钥运算,具有强的实用性.

Two-party certificateless authenticated key agreement protocol with enhanced security

Two-party certificateless authenticated key agreement(CL-AKA) protocol is a hot topic in the field of wireless communication security. An improved two-party CL-AKA protocol with enhanced security is proposed,which is of provable security and unforgeability in the extended Canetti-Krawczyk(eCK) security model based on the hardness assumption of the computational Diffie Hellman(CDH) problem. Compared with other similar protocols, it is more efficient and can satisfy security properties such as free of the centralized management of certificate and key, free of bilinear pairings, two-party authentication, resistant to unknown key-share attack, key compromise impersonation attacks, the man-in-the-middle-attack(MIMA) of key generation center(KGC), etc. These properties make the proposed protocol have better performance and adaptability for military communication.

基于ECC的IMS AKA鉴权机制研究

作为新一代的软交换平台,IMS的安全性问题不容忽视。认证鉴权作为用户接入安全的重要环节,是控制用户访问核心网络、提升系统安全的关键手段。其中,具备双向认证的AKA机制,以安全强度高、对接入网络无需求等特点被广泛认可。但在实际应用过程中,该机制依然存在一些安全问题,如注册消息存在被篡改的风险、用户认证数据可能被攻击者窃取等。通过对IMS AKA机制的安全漏洞进行分析,基于ECC算法原理提出了改进型AKA鉴权机制,并对该机制应用于IMS网络的安全性进行了评估分析。

Authenticated Diffie-Hellman Key Agreement Protocol with Forward Secrecy

Forward secrecy is an important security property in key agreement protocol. Based on Ham＇s protocol, in this paper a new authenticated Diffie-Hellman key agreement protocol with half forward secrecy is proposed. This protocol is also based on a single cryptographic assumption, and is user authentication and shared key authentication. More importantly, our protocol provides forward secrecy with respect to one of the parties. For this reason, besides the advantages of Ham＇s protocol, in practice, our protocol can reduce the damages resulted from the disclosure of the user＇s secret key and it is very beneficial to today＇s communication with portable devices.

基于PCL的3GPP-AKA协议的形式化分析与证明

3GPP-AKA协议在第三代移动通信的安全性方面起着至关重要的作用,它保证了移动用户MS与VLR/HLR之间的双向认证及密钥协商。文中通过协议组合逻辑(PCL)对3GPP-AKA协议进行了形式化分析及安全性证明。分析表明3GPP-AKA协议可以满足它的安全目标,因此该协议可以安全的作为第三代移动通信中的认证和密钥分配协议。

一种改进的WLAN-3G融合网络认证协议

本文在分析了现有3GPP WLAN-3G融合网络接入认证协议EAP-AKA的优势和不足的基础上,引入WAPI证书鉴别机制,提出WAPI-3G互联结构模型,并针对该互联模型设计了一种接入认证协议EAP-WAPI.本文提议的WLAN-3G互联结构模型及接入认证机制解决了融合组网环境下WLAN终端统一接入认证的问题.分析和仿真结果表明,相比于原有的WAPI认证协议WAPI-XG1,本文所提议的协议具有较高的安全性和执行效率.

一种安全增强型无线认证与密钥协商协议

针对当前3G网络身份认证与密钥协商方案存在扩展性差、用户身份信息易泄露的问题,提出一种基于无线公钥体制的安全增强型无线认证与密钥协商协议,实现实体间的双向身份认证,保护空中接口及有线通信链路,防止用户和接入网络身份标识泄露。该方案支持数字签名,可提供不可否认性业务。形式化方法验证分析表明,该协议能够满足安全需求。

改进的基于椭圆曲线加密的3G认证与密钥协商协议

针对第三代移动通信系统(3G)中采用的认证与密钥协商(AKA)协议存在安全漏洞和密钥管理困难等问题,采用基于椭圆曲线密码(ECC)和公钥体制协商会话密钥、对称加密算法加密消息的方法,提出了一种应用于3G业务中的改进协议。该协议不仅有效克服了AKA协议中存在的各种缺陷,避免了复杂的密钥管理难题,而且相比其他协议更简单容易,具有实际应用性。

基于公钥的3G认证和密钥分配协议

分析了3G认证与密钥协商协议(AKA)的过程和特点,指出了存在的缺陷,提出了一种新的AKA改进方案。该方案实现了移动设备(ME)和拜访位置寄存器(VLR)的相互认证,产生的会话密钥对双方都是公正的;该方法避免了双方必须通过资源有限的无线信道传送自己的公钥证书,几乎不需要可信赖第三方参与;同时解决了网络端信息传输的安全性。并对新方案的安全性进行了形式化分析,证明了该协议具有较强的实用性。

大规模延迟容忍网络中基于分级身份的认证密钥协商协议

大规模延迟容忍网络具有覆盖范围广、链路间歇性连通及通信时延长等特点,这使得现有认证密钥协商协议存在系统管理瓶颈及通信时延长等问题。设计了一种适用于大规模延迟容忍网络环境下的认证密钥协商协议,依赖基于分级身份的密码机制,通过密钥分级派生,减少系统管理瓶颈,同时消除对证书的依赖,减少协商时延。与现有通用环境下基于分级身份的同类协议相比,该协议的通信开销及双线性对计算开销较小,且均为常量,不受节点层次数影响,可扩展性更强,并且具有密钥派生控制功能。最后,在标准模型下证明了协议的安全性。

两个认证密钥协商协议的前向安全性分析

目前,网络安全及隐私受到广泛关注。前向安全性是Günther在1989年提出的一种认证密钥协商协议(AKA)的安全属性(doi:10.1007/3-540-46885-4_5),该性质经过30年的蓬勃发展已经成为研究领域的热点之一。该文主要分析了MZK20和VSR20两个AKA协议。首先在启发式分析的基础上,利用BAN逻辑分析了MZK20协议不具有弱前向安全性;其次利用启发式分析和Scyther工具证明了VSR20协议不具备前向安全性。最后,在分析VSR20协议设计缺陷的基础上,提出了改进方案,并在eCK模型下证明了改进后协议的安全性;并且,结合Scyther软件证明了改进VSR20协议与VSR20协议相比明显提高了安全性。

Preserving Privacy of User Identity Based on Pseudonym Variable in 5G

The fifth generation(5G)system is the forthcoming generation of the mobile communication system.It has numerous additional features and offers an extensively high data rate,more capacity,and low latency.However,these features and applications have many problems and issues in terms of security,which has become a great challenge in the telecommunication industry.This paper aimed to propose a solution to preserve the user identity privacy in the 5G system that can identify permanent identity by using Variable Mobile Subscriber Identity,which randomly changes and does not use the permanent identity between the user equipment and home network.Through this mechanism,the user identity privacy would be secured and hidden.Moreover,it improves the synchronization between mobile users and home networks.Additionally,its compliance with the Authentication and Key Agreement(AKA)structure was adopted in the previous generations.It can be deployed efficiently in the preceding generations because the current architecture imposes minimal modifications on the network parties without changes in the authentication vector’s message size.Moreover,the addition of any hardware to the AKA carries minor adjustments on the network parties.In this paper,the ProVerif is used to verify the proposed scheme.